29 articles tagged JWT.
OAuth2 has a fairly straightforward model. A client authenticates to an authorization server, obtains an access token, and uses that token to access a protected resource.
Read article: OAuth2 JWT Bearer Tokens (RFC-7523): When a JWT Becomes Your OAuth2 CredentialIf you’ve ever read a specification like WebAuthn, DID Core, SD-JWT VC, BBS Signatures, OID4VCI, or OID4VP, you’ve probably encountered references to P-256, secp256k1, Ed25519, or BLS12–381.
Read article: Elliptic Curve Groups: The Mathematical Engine Behind Modern Digital IdentityThere is a recurring problem in the Verifiable Credentials world.
Read article: SD-JWT VC vs. BBS-2023: Why These Aren’t Really the Things You’re ComparingSelective Disclosure is fundamentally a mathematical concept. The protocols (SD-JWT VC, BBS-2023, AnonCreds, Idemix, U-Prove, etc.) are really just engineering built on top of several branches of mathematics.
Read article: Selective Disclosure: The MathWebAuthn is actually the tip of a much larger iceberg. Like the SD-JWT VC spec, it is built upon several W3C, FIDO Alliance, and IETF specifications. Together, these define a complete passwordless authentication ecosystem.
Read article: WebAuthN: Passwordless LoginsAnother day, another identity specification to debug.
Read article: Identity Protocol Debugger Now Supports SD-JWT VC Issuance and Presentation FlowsI’ve touched on the topic of using JWT as an Access Token on several previous blog posts:
Read article: JWT as Oauth2 Access Tokens & Refresh Tokens— Invalidation: The Awkward RealityThe Internet Engineering Task Force (IETF) has 10K+ published Request For Comments (RFCs) documents. The industry hears about RFCs all the time. But, as the name implies (“request for comments”) that isn’t the final step in the process. A very small number of RFCs are promoted to Internet…
Read article: How Many IETF RFCs Actually Become Standards?If you’ve ever opened the specifications surrounding SD-JWT Verifiable Credentials and thought, “Surely this is a straightforward document that defines a credential format.”
Read article: SD-JWT VC: The Identity Industry’s Latest Attempt to Win a Nobel Prize in AcronymsFor anyone who has been paying attention, this blog post has been a long-time coming for multiple reasons. First, this is my first blog post in a couple of years — I’ve been heads down on a couple of projects for awhile now. This is literally the first time I’ve “come up for air” since the last…
Read article: RFC 9068: A JWT-Based OAuth2 Access Token Format Standard
